From patchwork Mon Feb 13 05:33:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Morris X-Patchwork-Id: 9568781 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2ED5460572 for ; Mon, 13 Feb 2017 05:33:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1E2512808F for ; Mon, 13 Feb 2017 05:33:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 130B828178; Mon, 13 Feb 2017 05:33:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 3C33A2808F for ; Mon, 13 Feb 2017 05:33:28 +0000 (UTC) Received: (qmail 13928 invoked by uid 550); 13 Feb 2017 05:33:26 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 13896 invoked from network); 13 Feb 2017 05:33:25 -0000 Date: Mon, 13 Feb 2017 16:33:13 +1100 (AEDT) From: James Morris To: linux-security-module@vger.kernel.org cc: kernel-hardening@lists.openwall.com Message-ID: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Subject: [kernel-hardening] [RFC PATCH 2/4] security: mark nf ops in SELinux and Smack as __ro_after_init X-Virus-Scanned: ClamAV using ClamSMTP Both SELinux and Smack register Netfilter operations during init, which then don't change. Mark these ops as __ro_after_init. Signed-off-by: James Morris --- security/selinux/hooks.c | 2 +- security/smack/smack_netfilter.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 9599e97..37a7866 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6379,7 +6379,7 @@ void selinux_complete_init(void) #if defined(CONFIG_NETFILTER) -static struct nf_hook_ops selinux_nf_ops[] = { +static struct nf_hook_ops selinux_nf_ops[] __ro_after_init = { { .hook = selinux_ipv4_postroute, .pf = NFPROTO_IPV4, diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 205b785..b945f2c 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -57,7 +57,7 @@ static unsigned int smack_ipv4_output(void *priv, return NF_ACCEPT; } -static struct nf_hook_ops smack_nf_ops[] = { +static struct nf_hook_ops smack_nf_ops[] __ro_after_init = { { .hook = smack_ipv4_output, .pf = NFPROTO_IPV4,